SOC Shift Lead - Information Security

Elevance Health•Indianapolis, IN

2d•$102,880 - $185,184•Hybrid

About The Position

The Security Analyst Sr. is responsible for managing the delivery of information and network security systems and/or technology services, which may include server, desktop, software, network, database, and helpdesk components. This role serves as an escalation point for junior analysts during security event investigations and incident response activities. It also involves mentoring and guiding junior analysts to improve investigation quality and operational consistency, coordinating analyst shift activities, and assisting with maintaining operational coverage schedules, including on-call coordination and PTO planning. The position also assists with the development and maintenance of SOC procedures, playbooks, and operational documentation. Additionally, the role provides trouble resolution on complex problems, leads implementations for system and network security technologies, and develops testing plans to ensure quality of implementation. It coordinates and prepares the reporting of data security events and incidents, provides system and network architecture support for information and network security technologies, and offers technical support to business and technology associates in risk assessments and the implementation of appropriate information security procedures, standards, and technologies. The role represents major upgrades and reconfigurations in change control, designs and analyzes a mix of vendor services meeting business and information security requirements, and maintains relationships with key vendors. It leads 'lights on' initiatives to consolidate equipment and/or implement business relocations, determines and performs complex configuration changes to meet business and information security requirements, and performs capacity analysis, recommending and implementing capacity increases. The role serves as the technical escalation for results of preventative maintenance routines, supervises preventative maintenance, represents infrastructure security support in significant projects, and performs the most complex operations and administration tasks. It responds to level 3 & 4 change and problem requests without supervision and leads level 1 & 2 incident recoveries and root cause analysis.

Requirements

Requires a bachelor’s degree or equivalent combination of education and experience that would provide the knowledge to perform such work.
Experience must include a minimum of 3 years experience in a support & operations or design & engineering role in any of the following areas: access management or network security technologies, servers, networks, Network communications, telecommunications, operating systems, middleware, disaster recovery, collaboration technologies, hardware/software support or other infrastructure services role; or any combination of education and experience, which would provide an equivalent background.
Requires experience providing top-tier support for 3 or more of the information security technology areas: 1) Access Control, 2) Application Security, 3) Business Continuity and Disaster Recovery Planning, 4) Cryptography, 5) Information Security and Risk Management 6) Legal, Regulations, 7) Compliance and Investigations, 8) Operations Security, 9) Physical (Environmental) Security, 10) Security Architecture and Design, 11) Telecommunications and Network Security.

Nice To Haves

Technical security certifications (e.g. Systems Security Certified Practitioner) strongly preferred. Such as: GCIH, GCIA, CompTIA CySA+, BTL2
Experience responding to incidents associated with financially-motivated and APT threat actors
Strong foundational knowledge of Windows and Cloud Forensics
BA/BS degree in Information System and Computer Science or related field of study strongly preferred.
Experience working in a Security Operations Center (SOC) environment with incident monitoring, triage, and escalation responsibilities preferred.
Experience serving as a technical lead, shift lead, or escalation resource for security operations teams preferred.
Familiarity with SIEM platforms, endpoint detection and response (EDR) tools, and security event analysis preferred.
Experience developing or maintaining SOC playbooks, runbooks, and standard operating procedures preferred.

Responsibilities

Serves as an escalation point for junior analysts during security event investigations and incident response activities.
Mentor and provide guidance to junior analysts to improve investigation quality and operational consistency.
Coordinate analyst shift activities and assist with maintaining operational coverage schedules, including on-call coordination and PTO planning.
Assist with development and maintenance of SOC procedures, playbooks, and operational documentation.
Provides trouble resolution on complex problems and leads implementations for system and network security technologies; develops testing plans to ensure quality of implementation.
Coordinates and prepares the reporting of data security events and incidents; provides system and network architecture support for information and network security technologies.
Provides technical support to business and technology associates in risk assessments and implementation of appropriate information security procedures, standards and technologies.
Represents major upgrades and reconfigurations in change control.
Design & analyze mix of vendor services meeting business and information security requirements; maintains relationship with key vendors.
Leads lights on initiatives to consolidate equipment and/or implement business relocations.
Determine and perform complex configuration changes to meet business and information security requirements.
Perform capacity analysis; recommend and implement capacity increases.
Serve as the technical escalation for results of preventative maintenance routines; supervise preventative maintenance; represents infrastructure security support in significant projects and performs the most complex operations and administration tasks.
Respond to level 3 & 4 change and problem requests without supervision.
Lead level 1 & 2 incident recoveries and root cause analysis.